[pull] main from pingdotgg:main

.github/actions/setup-apt-mirrors/action.yml

@@ -0,0 +1,22 @@
+name: Setup APT mirrors
+description: Configure Ubuntu package downloads with automatic mirror failover.
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        # Replace the existing Blacksmith mirror list as well as direct sources.
+        printf '%s\tpriority:%s\n' \
+          https://archive.ubuntu.com/ubuntu 1 \
+          https://mirrors.edge.kernel.org/ubuntu 2 \
+          https://mirror.math.princeton.edu/pub/ubuntu 3 \
+          | sudo tee /etc/apt/blacksmith-ubuntu-mirrors.txt > /dev/null
+
+        # APT's mirror transport retries each file against the next server.
+        sudo find /etc/apt -maxdepth 2 -type f \( -name '*.list' -o -name '*.sources' \) \
+          -exec sed -i -E \
+          's#https?://(([^/]+\.)?archive|security)\.ubuntu\.com/ubuntu/?#mirror+file:/etc/apt/blacksmith-ubuntu-mirrors.txt#g' {} +
+
+        # Move on to a fallback before an unreachable server exhausts the job.
+        printf '%s\n' 'Acquire::http::Timeout "15";' 'Acquire::https::Timeout "15";' \
+          | sudo tee /etc/apt/apt.conf.d/80-mirror-timeouts > /dev/null

.github/workflows/ci.yml

@@ -45,14 +45,22 @@ jobs:
       - name: Ensure Electron runtime is installed
         run: vp run --filter @t3tools/desktop ensure:electron
 
+      # Export cleanup is still a manual audit; files and dependencies have no baseline.
+      - name: Check unused files and dependencies
+        run: vp run knip:check
+
       - name: Check
         run: vp check
 
       - name: Typecheck
         run: vpr typecheck
 
+      - uses: ./.github/actions/setup-apt-mirrors
+
       - name: Install browser secret helper build libraries
-        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+        run: |
+          sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
+          sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
 
       - name: Build desktop pipeline
         run: vp run build:desktop
@@ -88,8 +96,12 @@ jobs:
       - name: Ensure Electron runtime is installed
         run: vp run --filter @t3tools/desktop ensure:electron
 
+      - uses: ./.github/actions/setup-apt-mirrors
+
       - name: Install browser secret helper build libraries
-        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+        run: |
+          sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
+          sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
 
       - name: Test
         run: vp run --parallel --concurrency-limit 4 --filter '!t3' --filter '!@t3tools/monorepo' test

.github/workflows/release.yml

@@ -216,6 +216,8 @@ jobs:
       - name: Typecheck
         run: vp run typecheck
 
+      - uses: ./.github/actions/setup-apt-mirrors
+
       - name: Install browser secret helper build libraries
         run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
 
@@ -519,14 +521,17 @@ jobs:
           $setupExe = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\setup.exe"
           $proc = Start-Process -FilePath $setupExe `
             -ArgumentList "modify", "--installPath", "`"$installPath`"", "--add", `
-            "Microsoft.VisualStudio.Component.VC.Tools.x86.x64.Spectre", "--quiet", "--norestart" `
+            "Microsoft.VisualStudio.Component.VC.Runtimes.x86.x64.Spectre", "--quiet", "--norestart" `
             -Wait -PassThru -NoNewWindow
           if ($null -eq $proc -or $proc.ExitCode -ne 0) {
             $code = if ($null -ne $proc) { $proc.ExitCode } else { 1 }
             Write-Error "Visual Studio Installer failed with exit code $code"
             exit $code
           }
 
+      - uses: ./.github/actions/setup-apt-mirrors
+        if: matrix.platform == 'linux'
+
       - name: Install Linux desktop build libraries
         if: matrix.platform == 'linux'
         shell: bash

apps/desktop/src/electron/ElectronDialog.test.ts

@@ -43,7 +43,6 @@ describe("ElectronDialog", () => {
       );
 
       assert.instanceOf(error, ElectronDialog.ElectronDialogPickFolderError);
-      assert.isTrue(ElectronDialog.isElectronDialogError(error));
       assert.strictEqual(error.ownerWindowId, 7);
       assert.strictEqual(error.defaultPath, "/workspace");
       assert.strictEqual(error.cause, cause);

apps/desktop/src/electron/ElectronDialog.ts

@@ -73,7 +73,6 @@ export const ElectronDialogError = Schema.Union([
   ElectronDialogShowErrorBoxError,
 ]);
 export type ElectronDialogError = typeof ElectronDialogError.Type;
-export const isElectronDialogError = Schema.is(ElectronDialogError);
 
 export interface ElectronDialogPickFolderInput {
   readonly owner: Option.Option<Electron.BrowserWindow>;

apps/desktop/src/electron/ElectronTheme.test.ts

@@ -64,7 +64,6 @@ describe("ElectronTheme", () => {
       const error = yield* Effect.flip(electronTheme.setSource("dark"));
 
       assert.instanceOf(error, ElectronTheme.ElectronThemeSetSourceError);
-      assert.isTrue(ElectronTheme.isElectronThemeSetSourceError(error));
       assert.strictEqual(error.source, "dark");
       assert.strictEqual(error.cause, cause);
       assert.include(error.message, "dark");

apps/desktop/src/electron/ElectronTheme.ts

@@ -19,8 +19,6 @@ export class ElectronThemeSetSourceError extends Schema.TaggedErrorClass<Electro
   }
 }
 
-export const isElectronThemeSetSourceError = Schema.is(ElectronThemeSetSourceError);
-
 export class ElectronTheme extends Context.Service<
   ElectronTheme,
   {

apps/desktop/src/electron/ElectronUpdater.test.ts

@@ -71,7 +71,6 @@ describe("ElectronUpdater", () => {
       const error = yield* updater.checkForUpdates.pipe(Effect.flip);
 
       assert.instanceOf(error, ElectronUpdater.ElectronUpdaterCheckForUpdatesError);
-      assert.isTrue(ElectronUpdater.isElectronUpdaterError(error));
       assert.equal(error.channel, "beta");
       assert.strictEqual(error.cause, cause);
       assert.equal(error.message, "Electron updater failed to check for updates on channel beta.");
@@ -89,7 +88,6 @@ describe("ElectronUpdater", () => {
       const error = yield* updater.downloadUpdate.pipe(Effect.flip);
 
       assert.instanceOf(error, ElectronUpdater.ElectronUpdaterDownloadUpdateError);
-      assert.isTrue(ElectronUpdater.isElectronUpdaterError(error));
       assert.equal(error.channel, "nightly");
       assert.strictEqual(error.cause, cause);
       assert.equal(
@@ -126,7 +124,6 @@ describe("ElectronUpdater", () => {
         .pipe(Effect.flip);
 
       assert.instanceOf(error, ElectronUpdater.ElectronUpdaterQuitAndInstallError);
-      assert.isTrue(ElectronUpdater.isElectronUpdaterError(error));
       assert.equal(error.channel, "alpha");
       assert.equal(error.isSilent, true);
       assert.equal(error.isForceRunAfter, false);

apps/desktop/src/electron/ElectronUpdater.ts

@@ -54,7 +54,6 @@ export const ElectronUpdaterError = Schema.Union([
   ElectronUpdaterQuitAndInstallError,
 ]);
 export type ElectronUpdaterError = typeof ElectronUpdaterError.Type;
-export const isElectronUpdaterError = Schema.is(ElectronUpdaterError);
 
 export class ElectronUpdater extends Context.Service<
   ElectronUpdater,

apps/desktop/src/electron/ElectronWindow.test.ts

@@ -79,7 +79,6 @@ describe("ElectronWindow", () => {
       const error = yield* electronWindow.create(options).pipe(Effect.flip);
 
       assert.instanceOf(error, ElectronWindow.ElectronWindowCreateError);
-      assert.isTrue(ElectronWindow.isElectronWindowCreateError(error));
       assert.deepEqual(error.options, {
         title: "T3 Code",
         width: 1100,

apps/desktop/src/electron/ElectronWindow.ts

@@ -58,8 +58,6 @@ export class ElectronWindowCreateError extends Schema.TaggedErrorClass<ElectronW
   }
 }
 
-export const isElectronWindowCreateError = Schema.is(ElectronWindowCreateError);
-
 export class ElectronWindowOperationError extends Schema.TaggedErrorClass<ElectronWindowOperationError>()(
   "ElectronWindowOperationError",
   {

apps/desktop/src/linuxSecretStorage.test.ts

@@ -3,7 +3,6 @@ import { describe, expect, it } from "vite-plus/test";
 import {
   normalizeLinuxPasswordStorePreference,
   resolveLinuxPasswordStoreSwitch,
-  resolveLinuxSecretStorageUnavailableMessage,
 } from "./linuxSecretStorage.ts";
 
 const autoSwitch = (env: NodeJS.ProcessEnv) =>
@@ -124,80 +123,4 @@ describe("linuxSecretStorage", () => {
       }),
     ).toBe("gnome-libsecret");
   });
-
-  it("uses GNOME Keyring remediation for libsecret and unknown backends", () => {
-    expect(
-      resolveLinuxSecretStorageUnavailableMessage({
-        configuredPreference: "auto",
-        selectedBackend: "gnome_libsecret",
-        env: { XDG_CURRENT_DESKTOP: "niri" },
-      }),
-    ).toContain("GNOME Keyring");
-  });
-
-  it("prefers explicit libsecret selection over KDE desktop heuristics", () => {
-    expect(
-      resolveLinuxSecretStorageUnavailableMessage({
-        configuredPreference: "gnome-libsecret",
-        selectedBackend: "unknown",
-        env: { XDG_CURRENT_DESKTOP: "KDE" },
-      }),
-    ).toContain("GNOME Keyring");
-    expect(
-      resolveLinuxSecretStorageUnavailableMessage({
-        configuredPreference: "auto",
-        selectedBackend: "gnome_libsecret",
-        env: { XDG_CURRENT_DESKTOP: "KDE" },
-      }),
-    ).toContain("GNOME Keyring");
-  });
-
-  it("prefers explicit KWallet preference over selected gnome-libsecret backend", () => {
-    expect(
-      resolveLinuxSecretStorageUnavailableMessage({
-        configuredPreference: "kwallet6",
-        selectedBackend: "gnome_libsecret",
-        env: { XDG_CURRENT_DESKTOP: "niri" },
-      }),
-    ).toContain("KWallet");
-    expect(
-      resolveLinuxSecretStorageUnavailableMessage({
-        configuredPreference: "kwallet",
-        selectedBackend: "gnome-libsecret",
-        env: {},
-      }),
-    ).toContain("KWallet");
-  });
-
-  it("uses KWallet remediation wording for KDE-looking sessions", () => {
-    expect(
-      resolveLinuxSecretStorageUnavailableMessage({
-        configuredPreference: "auto",
-        selectedBackend: "kwallet6",
-        env: {},
-      }),
-    ).toContain("KWallet");
-    expect(
-      resolveLinuxSecretStorageUnavailableMessage({
-        configuredPreference: "auto",
-        selectedBackend: "unknown",
-        env: { XDG_CURRENT_DESKTOP: "KDE" },
-      }),
-    ).toContain("KWallet");
-    expect(
-      resolveLinuxSecretStorageUnavailableMessage({
-        configuredPreference: "auto",
-        selectedBackend: "unknown",
-        env: { DESKTOP_SESSION: "plasmawayland" },
-      }),
-    ).toContain("KWallet");
-    // A desktop name outranks a bare KDE marker when choosing the wording.
-    expect(
-      resolveLinuxSecretStorageUnavailableMessage({
-        configuredPreference: "auto",
-        selectedBackend: "unknown",
-        env: { GDMSESSION: "gnome", KDE_FULL_SESSION: "true" },
-      }),
-    ).toContain("GNOME Keyring");
-  });
 });

apps/desktop/src/linuxSecretStorage.ts

@@ -25,9 +25,6 @@ const ELECTRON_KDE_DESKTOP = "KDE";
 // Chromium recognizes LXQt and still selects basic text for it, so it does need a forced backend.
 const ELECTRON_UNPROTECTED_DESKTOPS = new Set(["LXQt"]);
 
-const KDE_NAME_PREFIXES = ["kde", "plasma"];
-const NEGATIVE_FLAG_VALUES = new Set(["0", "false", "no", "off"]);
-
 export function normalizeLinuxPasswordStorePreference(
   value: unknown,
 ): LinuxPasswordStorePreference {
@@ -77,102 +74,6 @@ function electronSelectsProtectedBackend(env: NodeJS.ProcessEnv): boolean {
   return false;
 }
 
-export function resolveLinuxSecretStorageUnavailableMessage(input: {
-  readonly configuredPreference: LinuxPasswordStorePreference;
-  readonly selectedBackend: string | null;
-  readonly env: NodeJS.ProcessEnv;
-}): string {
-  if (input.configuredPreference === "gnome-libsecret") {
-    return getGnomeKeyringRemediationMessage();
-  }
-
-  if (
-    input.configuredPreference === "kwallet" ||
-    input.configuredPreference === "kwallet5" ||
-    input.configuredPreference === "kwallet6"
-  ) {
-    return getKWalletRemediationMessage();
-  }
-
-  const backend = normalizeSelectedStorageBackend(input.selectedBackend);
-  if (backend === "gnome-libsecret") {
-    return getGnomeKeyringRemediationMessage();
-  }
-
-  if (
-    backend === "kwallet" ||
-    backend === "kwallet5" ||
-    backend === "kwallet6" ||
-    looksLikeKdeSession(input.env)
-  ) {
-    return getKWalletRemediationMessage();
-  }
-
-  return getGnomeKeyringRemediationMessage();
-}
-
-function getGnomeKeyringRemediationMessage(): string {
-  return "T3 Code could not access GNOME Keyring to save this environment credential. Install and start GNOME Keyring, then restart T3 Code.";
-}
-
-function getKWalletRemediationMessage(): string {
-  return "T3 Code could not access KWallet to save this environment credential. Enable the KDE wallet subsystem in System Settings, then restart T3 Code.";
-}
-
-// Advisory only: this picks between the GNOME Keyring and KWallet wording in the failure notice. It
-// never decides which backend to select, so a loose match costs a user slightly wrong instructions
-// rather than an unprotected credential store.
-function looksLikeKdeSession(env: NodeJS.ProcessEnv): boolean {
-  const currentDesktopNames = nonEmptyDesktopNames(env.XDG_CURRENT_DESKTOP);
-  if (currentDesktopNames.length > 0) {
-    return currentDesktopNames.some(isKdeDesktopName);
-  }
-
-  const legacyNames = legacyDesktopNames(env);
-  if (legacyNames.length > 0) {
-    return legacyNames.some(isKdeDesktopName);
-  }
-
-  return isSet(env.KDE_SESSION_VERSION) || isAffirmativeFlag(env.KDE_FULL_SESSION);
-}
-
-function isKdeDesktopName(name: string): boolean {
-  return KDE_NAME_PREFIXES.some((prefix) => name.startsWith(prefix));
-}
-
-function legacyDesktopNames(env: NodeJS.ProcessEnv): string[] {
-  return [env.XDG_SESSION_DESKTOP, env.DESKTOP_SESSION, env.GDMSESSION].flatMap((entry) => {
-    const normalized = normalizeDesktopName(entry);
-    return normalized ? [normalized] : [];
-  });
-}
-
-function nonEmptyDesktopNames(value: string | undefined): string[] {
-  return splitDesktopNameList(value).flatMap((entry) => {
-    const normalized = normalizeDesktopName(entry);
-    return normalized ? [normalized] : [];
-  });
-}
-
-function isSet(value: string | undefined): boolean {
-  return Boolean(value?.trim());
-}
-
-function isAffirmativeFlag(value: string | undefined): boolean {
-  const normalized = value?.trim().toLowerCase();
-  return normalized ? !NEGATIVE_FLAG_VALUES.has(normalized) : false;
-}
-
 function splitDesktopNameList(value: string | undefined): string[] {
   return value?.split(":") ?? [];
 }
-
-function normalizeDesktopName(value: string | undefined): string | null {
-  const normalized = value?.trim().toLowerCase();
-  return normalized && normalized.length > 0 ? normalized : null;
-}
-
-function normalizeSelectedStorageBackend(value: string | null): string | null {
-  const normalized = value?.trim().toLowerCase().replace(/_/gu, "-");
-  return normalized && normalized.length > 0 ? normalized : null;
-}